pa sampling

Issued: May 2013 PA 2320-3: Audit Sampling

© 2013 The Institute of Internal Auditors www.globaliia.org

Practice Advisory 2320-3: Audit Sampling

Primary Related Standard 2320 – Analysis and Evaluation Internal auditors must base conclusions and engagement results on appropriate analyses and evaluations. Related Practice Advisory 2240 – 1 Engagement Work Program Internal auditors develop and obtain documented approval of work programs before commencing the internal audit engagement. The work program includes methodologies to be used, such as technology-based audit and sampling techniques.

1. Audit sampling is used to provide factual evidence and a reasonable basis to draw

conclusions about a population from which a sample is selected. The internal auditor should design and select an audit sample, perform audit procedures, and evaluate sample results to obtain sufficient, reliable, relevant, and useful audit evidence to achieve the engagement’s objectives. Sufficient, in that the information is factual, adequate, and convincing so that a prudent, informed person would reach the same conclusions as the auditor. Reliable, in that the information is the best attainable information through the use of appropriate engagement techniques. Relevant, in that the information supports engagement observations and recommendations and is consistent with the objectives for the engagement. Useful, in that the information helps provide assurance that the organization will meet its goals.

2. Audit sampling is defined as, the application of audit procedures to less than 100

percent of items within a class of transactions or account balance such that all sampling units have a chance of selection. Population is defined as, the entire set of data from which a sample is selected and about which the internal auditor wishes to draw conclusions. Sampling risk is defined as, the risk that the internal auditor’s conclusion based on a sample may be different from the conclusion if the entire population were subjected to the same audit procedure.

Statistical and Nonstatistical Sampling 3. Statistical sampling (e.g., random and systematic) involves the use of techniques

from which mathematically constructed conclusions regarding the population can be drawn. Statistical sampling allows the auditor to draw conclusions supported by arithmetic confidence levels (e.g., odds of an erroneous conclusion) regarding a population of data output. It is critical that the sample of transactions selected is representative of a population. Without ensuring that the sample represents the population, the ability to draw conclusions based on the review of the sample is limited, if not erroneous. The internal auditor should validate the completeness of the population to ensure that the sample is selected from an appropriate data set.



4. Nonstatistical sampling is an approach used by the auditor who wants to use his or

her own experience and knowledge to determine the sample size. Nonstatistical sampling (e.g., judgmental) may not be based objectively and, thus, results of a sample may not be mathematically supportable when extrapolated over the population. That is, the sample may be subject to bias and not representative of the population. The purpose of the test, efficiency, business characteristics, inherent risks, and impacts of the outputs are common considerations the auditor will use to guide the sampling approach. Nonstatistical sampling may be used when results are needed quickly and needed to confirm a condition rather than being needed to project the mathematical accuracy of the conclusions.

5. In forming an audit opinion or conclusion, auditors frequently do not examine all

available information, as it may be impractical and valid conclusions can be reached using audit sampling. When using statistical or nonstatistical sampling methods, the auditor should design and select an audit sample, perform audit procedures, and evaluate sample results to obtain sufficient, reliable, relevant, and useful audit evidence.

6. Techniques for audit sampling are varied. Examples of a few techniques include:

Random sampling — selection is not governed by predetermined considerations; every unit in the population has an equal chance of being selected.

Monetary unit sampling — used to identify monetary misstatement(s) that may exist in an account balance.

Stratified sampling — used to segregate the entire population into subgroups; usually a random selection from each of the subgroups is selected for review.

Attribute sampling — used to determine the characteristics of a population being evaluated.

Variable sampling — used to determine the monetary impact of characteristics of a population.

Judgmental sampling — based on the auditor’s professional judgment; meant to focus and confirm a condition that is reasonably thought to exist.

Discovery sampling — used where evidence of a single error or instance would call for intensive investigation.

7. When designing the size and structure of an audit sample, auditors should consider

the specific audit objectives, the nature of the population, and the sampling and selection methods. The auditor should consider the need to involve appropriate specialists in the design and analysis of sampling methodology.

8. The sampling approach will depend on the purpose of the sample. For compliance

testing of controls, attribute sampling is used typically, where the sampling approach is an event or transaction (e.g., a control such as an authorization on an invoice). For substantive testing, variable sampling is used often where the sampling unit is monetary.



9. Given that the population should be the entire set of data from which the auditor wishes to sample in order to reach a conclusion, the population from which the sample is drawn has to be appropriate and verified as complete for the specific audit objective.

10. To assist in the effective design of the sample, stratification may be appropriate.

Stratification is the process of segregating a population into homogenous subpopulations explicitly defined so that each sampling unit can belong to only one subpopulation depending on the criteria used for stratification.

Tolerable and Expected Definitions 11. When using a statistical sample, the auditor should consider concepts such as

sampling risk and tolerable and expected errors. Sampling risk arises from the possibility that the auditor’s conclusion may be different from the conclusion that would be reached if the entire population were subjected to the same audit procedure. There are two types of sampling risk:

Incorrect acceptance — the risk that the attribute or assertion tested is assessed as unlikely when, in fact, it is likely.

Incorrect rejection — the risk that the attribute or assertion tested is assessed as likely when, in fact, it is not likely.

Tolerable errors are the maximum numbers of errors that the auditor is willing to accept and still reach a conclusion that the underlying assertion is correct. This is not always the auditor’s decision and may be determined by the nature of the business, consultation with management or best practices. In some cases, an error of one will not be tolerable.

Expected errors are errors that the auditor expects in the population based on prior audit results, changes in processes, and evidence/conclusions from other sources.

12. The level of sampling risk that the auditor is willing to accept, tolerable error, and the

expected error all affect sample size. Sampling risk should be considered in relation to the audit risk approach and its components which include inherent risk, control risk, and detection risk.

13. Effective audit sampling procedures will increase the coverage, focus, and efficiency

of audits and will allow the auditor to provide assurance on business processes that impact the organization’s achievement of its goals and objectives. It is important that the auditor understand accepted guidance and standards on sampling along with the business processes and data he or she is working with when selecting the appropriate audit sampling technique.

14. Continuous auditing allows the internal auditor to test the whole population in a

timely fashion, while audit sampling facilitates the selection of less than 100 percent of the population.



15. The internal auditor should analyze possible errors detected in the sample to determine whether they are actually errors and, if appropriate, the nature and cause of the errors. For those that are assessed as errors, it should be determined whether additional testing is required.

16. When the expected audit evidence regarding a specific sample item cannot be

obtained, the auditor may be able to obtain sufficient audit evidence through performing alternative procedures on the item selected (see #6 above for examples of alternative procedures). If the auditor is unable to apply the designed audit procedures or alternative procedures to a selected item, the internal auditor should treat that item as a deviation from the prescribed control.

17. The internal auditor should project the results of the sample to the population with a

method of projection consistent with the method used to select the sample. The projection of the sample may involve estimating probable errors or deviations in the population and estimating errors that might not have been detected because of the imprecision of the technique, together with the qualitative aspects of errors found. Consideration should be given to whether the use of audit sampling has provided a reasonable basis for conclusions about the population that has been tested.

18. The auditor should consider whether errors in the population might exceed the

tolerable error by comparing the projected population error to the tolerable error, taking into account the results of other audit procedures relevant to the audit objective. When the projected population error exceeds the tolerable error, the auditor should reassess the sampling risk and, if that risk is unacceptable, consider extending the audit procedure or performing alternative audit procedures.

19. The audit workpapers should include sufficient detail to describe clearly the sampling

objective and the sampling process used. The workpapers should include the source of the population, the sampling method used, sampling parameters (e.g., random start number or method by which random start was obtained and sampling interval), items selected, details of audit tests performed, and conclusions reached.

20. When the internal auditor is reporting results of testing and the conclusion reached,

sufficient information needs to be reported for the reader to understand the basis of the conclusion.

Note: This is a practice advisory regarding audit sampling and is not designed to provide information regarding data analysis. For information regarding data analysis, please refer to The Institute of Internal Auditor’s Global Technology Audit Guide 16, entitled Data Analysis Technologies. Issued: May 2013

pa sampling

Documents